Privacy Policy

Information notice pursuant to Art. 13 of the Regulation (EU) 2016/679 (“GDPR”) and art 19 LPD

Why this information notice?

Roberto Cavalli S.p.A. and Auriel Investment SA subsidiary invite you to read the following Information notice in order to acquire all the information required by Article 13 of EU Regulation 2016/679 (hereinafter "EU Reg. 2016/69" or "GDPR") and by art.19 of Federal Law on Data Protection (hereinafter “LPD”). This notice relates to types and methods of processing personal data as stated below and connected to the purchase of a product.

Navigation data

Data belonging to this category: IP addresses, domain name, URI/URL addresses, time and method of request, response from server and a few information regarding the user-agent. More information available in the Cookie Policy.
Social media: For more information regarding the processing of personal data carried out by any Social Media platforms deployed on this website, please refer to their respective privacy policies.

Personal data we may collect and process

Personal data: any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can directly or indirectly be identified, in particular by reference to an identifier such as a name, an identification number, a location data, an online identifier or to one or more specific factors to the physical, physiological, genetic, mental, economic, cultural or social identity (C26, C27, C30). In this specific case, personal data that will be processed, depending on the relative purpose, are: name, surname, e-mail address, physical address, telephone number, date of birth, nationality, product ID, billing address and one or more postal shipping addresses, the identification data of one or more of your credit cards and information contained in the requests sent to Roberto Cavalli S.p.A.

JOINT CONTROLLERS AND DATA PROTECTION OFFICER (RPD - DPO)

Joint Controllers pursuant to art.26 of UE Reg. 2016/69 and pursuant to art.5 of LPD are:

Roberto Cavalli S.p.A. with registered office in Piazza San Babila 3, 20122 Milano (MI), represented by the legal representative pro tempore. You can freely contact the Data Controller sending an E-Mail to the following address: privacy@robertocavalli.com Roberto Cavalli S.p.A. has appointed the Data Protection Officer (RPD - DPO) pursuant to art.37, 38, 39 of the Reg. UE 2016/679. You can reach the appointed DPO in the above-mentioned registered offices or via E-Mail: dpo@robertocavalli.com
Auriel Investment SA with registered office in Vaile Giuseppe Cattori 11, 6900 Paradiso, Svwitzerland, represented by the legal representative pro tempore. You can freely contact the Data Controller by mail at Lardi & Partners SA Via Cantonale 19 6900 Lugano Switzerland

PURPOSES OF PROCESSING	LEGAL GROUND	DATA RETENTION	DATA CONFERRAL
A) Website browsing	Legitimate interest for technical cookies Art. 6 lett. f) and recital 47 GDPR overriding private interest LPD Consent for non-technical cookies Art 6.1.a) GDPR art. 6 cap. 6, 7; art 31 cap. 1 LPD	More information available in the cookie policy	For technical cookies, the provision of information is necessary. For non-technical cookies, their provision is optional and the lack of conferral will not affect the website navigation
B) Account creation The creation of the account will allow you to save contact information, payment methods, keep the history of purchases, book eventual returns, track the shipment, modify any previously provided consents to profiled marketing communications	Contract Art. 6(1)(b) GDPR Art. 31 (a) LPD	Up until the account is active and valid	In case of creation of a new account the provision of personal data is mandatory; nevertheless, some of them are optional
C) Purchasing goods	Contract Art. 6(1)(b) GDPR Art. 31 (a) LPD	10 year	The provision is necessary in order to proceed with the finalization of the purchase
D) Returning goods	Contract Art. 6(1)(b) GDPRArt. 31 (a) LPD	The information is kept for the necessary time to proceed with the evasion of the request	The E-mail address and the order ID are required to process the request
E) Contact requests	Pre-contractual measure Art. 6(1)(b) GDPRArt. 31 (a) LPD	up to 12 months	The provision is necessary to process the request
F) Personal shopper Asking for the assistance of a personal shopper you will have the opportunity to receive help, style advice	Pre-contractual Art. 6(1)(b) GDPRArt. 31 (a) LPD	The information is kept for the necessary time to proceed with the evasion of the request	The provision is necessary to process the request
G) Soft spam Joint Controllers will use the e-mail contact, the telephone number (calls, SMS and WhatsApp) provided by the Data Subject in the context of the purchase of a product, for sending communications concerning similar products to those purchased, without requiring the consent. Data Subject, during the collection or in occasion of sending this kind of communication, is informed about the possibility to object, at any time, in an easy and free way.	“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child(C47-C50) Art.6(1) (f) GDPR and Federal law against unfair competition, art.3 (o)(LCSI) The legitimate interest of Joint Controllers is connected with the possibility to keep in touch with the clients by sending communications withing the limits of products similar to those purchased by the clients. (art. 130 co. 4 d.lgs. 30 giugno 2003, n. 196)	Up to 5 years from the last purchase or from the date of registration if never made a purchase until opposition (opt-out) if earlier.	The provision is necessary. You may object at any time.
H) Direct Marketing by means of E-mail, phone calls and any kind of instant messages (calls, SMS and WhatsApp), paper mail depending on the provided information.	Consent	Up to 5 years from the last purchase or from the date of registration if never made a purchase until opposition (opt-out) if earlier	The provision is optional and where lacking you won’t be affected from carrying out other activities on this website
I) Profiled marketing communication by means of E-mail, phone calls, any kind of instant messages, paper mail depending on the provided information. We inform you that the profiling activity is carried out taking into account previous purchases and any product included in the wish-list	Consent art. 6 par. 1 lett. a) GDPR e art. 6 cap. 6, 7; art 31 cap. 1 LPD	Up to 5 years from the last purchase or from the date of registration if never made a purchase until opposition (opt-out) if earlier	The provision is optional and where lacking you won’t be affected from carrying out other activities on this website
J) Staff recruiting by means of the “work with us” area	Contract Art. 6(1)(b) GDPR Art. 31 (a) LPD	Up to 12 months	The provision is necessary for Data Controller to analyse the resume and proceed with the selection process

DATA RECIPIENTS

Personal data provided may be communicated to recipients acting as Processors (art. 28 of the Reg. EU 2016/679) and/or persons under the authority of the Controller and the Processor (art.29 of the Reg. UE 2016/679) for the pointed ahead purposes. You can request a complete listing of processors at the abovementioned addresses. Your data may be disclosed to recipients being part of the following categories: - subjects providing services and assistance to the database collecting all the data and to the commercial communications system; - Subjects providing services for the management of the information system and telecommunication networks, including e-mail, host and website; - Companies in the context of assistance and consultancy relationships; - Companies of the group to which Roberto Cavalli S.p.A. belongs; - Competent authorities for compliance with legal obligations and / or provisions of public bodies, upon request

WILL DATA BE TRANSFERRED TO COUNTRIES OUTSIDE THE EEA?

Data are transferred outside the EEA and specifically in Switzerland, Country that guarantees an adequate level of protection, and to the United Arab Emirates through Standard Contractual Clauses.

DATA SUBJECT RIGHTS

You may freely exercise your rights as indicated in sections 15 of GDPR and Section 4 of LPD, contacting the Joint Controllers at the abovementioned address. You have the right, at any time, to request the access to your personal data, their rectification, erasure, to ask for restriction. The controller shall communicate any rectification or erasure of data or processing restriction to each recipient to whom personal data have been disclosed. Upon data subject’s request the controller shall inform him regarding these latter. If the processing is based on a contract, you have the right to portability and in this case you will receive the data in a structured, commonly used and machine-readable format. You have the right to object, at any time, to the processing of personal data grounded on a legitimate interest and in cases where the legal basis is consent, you have the right to revoke the given consent without prejudice to the lawfulness of the processing based on the consent before the revocation. Personal data will be processed manually, electronically and by mean of automated processed. Please note that fully automated decision-making processes are not carried out. Without prejudice to any other administrative or judicial remedy, in case you consider the processing in contrast with Reg. UE 2016/679 or LPD you have the right to lodge a complaint with a supervisory authority (www.garanteprivacy.it https://www.edoeb.admin.ch/edoeb/it/home.html)

CHANGES TO THE INFORMATION NOTICE

Data Controllers reserve the right to modify, update, add or remove parts of this information. In order to facilitate the verification and modification of the text, the information will contain the date of revision.

Update date: May 22, 2024